1 /*
2 * Copyright (c) 2000-2020 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */
29 /*
30 * Copyright (c) 1982, 1986, 1989, 1993
31 * The Regents of the University of California. All rights reserved.
32 * (c) UNIX System Laboratories, Inc.
33 * All or some portions of this file are derived from material licensed
34 * to the University of California by American Telephone and Telegraph
35 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36 * the permission of UNIX System Laboratories, Inc.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 * 1. Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 * notice, this list of conditions and the following disclaimer in the
45 * documentation and/or other materials provided with the distribution.
46 * 3. All advertising materials mentioning features or use of this software
47 * must display the following acknowledgement:
48 * This product includes software developed by the University of
49 * California, Berkeley and its contributors.
50 * 4. Neither the name of the University nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
64 * SUCH DAMAGE.
65 *
66 * @(#)vfs_vnops.c 8.14 (Berkeley) 6/15/95
67 *
68 */
69 /*
70 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
71 * support for mandatory and extensible security protections. This notice
72 * is included in support of clause 2.2 (b) of the Apple Public License,
73 * Version 2.0.
74 */
75
76 #include <sys/param.h>
77 #include <sys/types.h>
78 #include <sys/systm.h>
79 #include <sys/kernel.h>
80 #include <sys/file_internal.h>
81 #include <sys/stat.h>
82 #include <sys/proc_internal.h>
83 #include <sys/kauth.h>
84 #include <sys/mount_internal.h>
85 #include <sys/namei.h>
86 #include <sys/vnode_internal.h>
87 #include <sys/ioctl.h>
88 #include <sys/fsctl.h>
89 #include <sys/tty.h>
90 #include <sys/ubc.h>
91 #include <sys/conf.h>
92 #include <sys/disk.h>
93 #include <sys/fsevents.h>
94 #include <sys/kdebug.h>
95 #include <sys/xattr.h>
96 #include <sys/ubc_internal.h>
97 #include <sys/uio_internal.h>
98 #include <sys/resourcevar.h>
99 #include <sys/signalvar.h>
100
101 #include <vm/vm_kern.h>
102 #include <vm/vm_map.h>
103
104 #include <miscfs/specfs/specdev.h>
105 #include <miscfs/fifofs/fifo.h>
106
107 #if CONFIG_MACF
108 #include <security/mac_framework.h>
109 #endif
110
111 #include <IOKit/IOBSD.h>
112 #include <libkern/section_keywords.h>
113
114 static int vn_closefile(struct fileglob *fp, vfs_context_t ctx);
115 static int vn_ioctl(struct fileproc *fp, u_long com, caddr_t data,
116 vfs_context_t ctx);
117 static int vn_read(struct fileproc *fp, struct uio *uio, int flags,
118 vfs_context_t ctx);
119 static int vn_write(struct fileproc *fp, struct uio *uio, int flags,
120 vfs_context_t ctx);
121 static int vn_select( struct fileproc *fp, int which, void * wql,
122 vfs_context_t ctx);
123 static int vn_kqfilter(struct fileproc *fp, struct knote *kn,
124 struct kevent_qos_s *kev);
125 static void filt_vndetach(struct knote *kn);
126 static int filt_vnode(struct knote *kn, long hint);
127 static int filt_vnode_common(struct knote *kn, struct kevent_qos_s *kev,
128 vnode_t vp, long hint);
129 static int vn_open_auth_finish(vnode_t vp, int fmode, vfs_context_t ctx);
130
131 const struct fileops vnops = {
132 .fo_type = DTYPE_VNODE,
133 .fo_read = vn_read,
134 .fo_write = vn_write,
135 .fo_ioctl = vn_ioctl,
136 .fo_select = vn_select,
137 .fo_close = vn_closefile,
138 .fo_drain = fo_no_drain,
139 .fo_kqfilter = vn_kqfilter,
140 };
141
142 static int filt_vntouch(struct knote *kn, struct kevent_qos_s *kev);
143 static int filt_vnprocess(struct knote *kn, struct kevent_qos_s*kev);
144
145 SECURITY_READ_ONLY_EARLY(struct filterops) vnode_filtops = {
146 .f_isfd = 1,
147 .f_attach = NULL,
148 .f_detach = filt_vndetach,
149 .f_event = filt_vnode,
150 .f_touch = filt_vntouch,
151 .f_process = filt_vnprocess,
152 };
153
154 /*
155 * Common code for vnode open operations.
156 * Check permissions, and call the VNOP_OPEN or VNOP_CREATE routine.
157 *
158 * XXX the profusion of interfaces here is probably a bad thing.
159 */
160 int
vn_open(struct nameidata * ndp,int fmode,int cmode)161 vn_open(struct nameidata *ndp, int fmode, int cmode)
162 {
163 return vn_open_modflags(ndp, &fmode, cmode);
164 }
165
166 int
vn_open_modflags(struct nameidata * ndp,int * fmodep,int cmode)167 vn_open_modflags(struct nameidata *ndp, int *fmodep, int cmode)
168 {
169 int error;
170 struct vnode_attr *vap;
171
172 vap = kalloc_type(struct vnode_attr, Z_WAITOK);
173
174 VATTR_INIT(vap);
175 VATTR_SET(vap, va_mode, (mode_t)cmode);
176
177 error = vn_open_auth(ndp, fmodep, vap, NULLVP);
178
179 kfree_type(struct vnode_attr, vap);
180
181 return error;
182 }
183
184 static int
vn_open_auth_finish(vnode_t vp,int fmode,vfs_context_t ctx)185 vn_open_auth_finish(vnode_t vp, int fmode, vfs_context_t ctx)
186 {
187 int error;
188
189 if ((error = vnode_ref_ext(vp, fmode, 0)) != 0) {
190 goto bad;
191 }
192
193 /* Call out to allow 3rd party notification of open.
194 * Ignore result of kauth_authorize_fileop call.
195 */
196 #if CONFIG_MACF
197 mac_vnode_notify_open(ctx, vp, fmode);
198 #endif
199 kauth_authorize_fileop(vfs_context_ucred(ctx), KAUTH_FILEOP_OPEN,
200 (uintptr_t)vp, 0);
201
202 return 0;
203
204 bad:
205 return error;
206 }
207
208 /*
209 * May do nameidone() to allow safely adding an FSEvent. Cue off of ni_dvp to
210 * determine whether that has happened.
211 */
212 static int
vn_open_auth_do_create(struct nameidata * ndp,struct vnode_attr * vap,int fmode,boolean_t * did_create,boolean_t * did_open,vfs_context_t ctx)213 vn_open_auth_do_create(struct nameidata *ndp, struct vnode_attr *vap, int fmode, boolean_t *did_create, boolean_t *did_open, vfs_context_t ctx)
214 {
215 uint32_t status = 0;
216 vnode_t dvp = ndp->ni_dvp;
217 int batched;
218 int error;
219 vnode_t vp;
220
221 batched = vnode_compound_open_available(ndp->ni_dvp);
222 *did_open = FALSE;
223
224 VATTR_SET(vap, va_type, VREG);
225 if (fmode & O_EXCL) {
226 vap->va_vaflags |= VA_EXCLUSIVE;
227 }
228
229 #if NAMEDRSRCFORK
230 if (ndp->ni_cnd.cn_flags & CN_WANTSRSRCFORK) {
231 if ((error = vn_authorize_create(dvp, &ndp->ni_cnd, vap, ctx, NULL)) != 0) {
232 goto out;
233 }
234 if ((error = vnode_makenamedstream(dvp, &ndp->ni_vp, XATTR_RESOURCEFORK_NAME, 0, ctx)) != 0) {
235 goto out;
236 }
237 *did_create = TRUE;
238 } else {
239 #endif
240 if (!batched) {
241 if ((error = vn_authorize_create(dvp, &ndp->ni_cnd, vap, ctx, NULL)) != 0) {
242 goto out;
243 }
244 }
245
246 error = vn_create(dvp, &ndp->ni_vp, ndp, vap, VN_CREATE_DOOPEN, fmode, &status, ctx);
247 if (error != 0) {
248 if (batched) {
249 *did_create = (status & COMPOUND_OPEN_STATUS_DID_CREATE) ? TRUE : FALSE;
250 } else {
251 *did_create = FALSE;
252 }
253
254 if (error == EKEEPLOOKING) {
255 if (*did_create) {
256 panic("EKEEPLOOKING, but we did a create?");
257 }
258 if (!batched) {
259 panic("EKEEPLOOKING from filesystem that doesn't support compound vnops?");
260 }
261 if ((ndp->ni_flag & NAMEI_CONTLOOKUP) == 0) {
262 panic("EKEEPLOOKING, but continue flag not set?");
263 }
264
265 /*
266 * Do NOT drop the dvp: we need everything to continue the lookup.
267 */
268 return error;
269 }
270 } else {
271 if (batched) {
272 *did_create = (status & COMPOUND_OPEN_STATUS_DID_CREATE) ? 1 : 0;
273 *did_open = TRUE;
274 } else {
275 *did_create = TRUE;
276 }
277 }
278 #if NAMEDRSRCFORK
279 }
280 #endif
281
282 vp = ndp->ni_vp;
283
284 if (*did_create) {
285 int update_flags = 0;
286
287 // Make sure the name & parent pointers are hooked up
288 if (vp->v_name == NULL) {
289 update_flags |= VNODE_UPDATE_NAME;
290 }
291 if (vp->v_parent == NULLVP) {
292 update_flags |= VNODE_UPDATE_PARENT;
293 }
294
295 if (update_flags) {
296 vnode_update_identity(vp, dvp, ndp->ni_cnd.cn_nameptr, ndp->ni_cnd.cn_namelen, ndp->ni_cnd.cn_hash, update_flags);
297 }
298
299 vnode_put(dvp);
300 ndp->ni_dvp = NULLVP;
301
302 #if CONFIG_FSE
303 if (need_fsevent(FSE_CREATE_FILE, vp)) {
304 add_fsevent(FSE_CREATE_FILE, ctx,
305 FSE_ARG_VNODE, vp,
306 FSE_ARG_DONE);
307 }
308 #endif
309 }
310 out:
311 if (ndp->ni_dvp != NULLVP) {
312 vnode_put(dvp);
313 ndp->ni_dvp = NULLVP;
314 }
315
316 return error;
317 }
318
319 /*
320 * This is the number of times we'll loop in vn_open_auth without explicitly
321 * yielding the CPU when we determine we have to retry.
322 */
323 #define RETRY_NO_YIELD_COUNT 5
324
325 /*
326 * Open a file with authorization, updating the contents of the structures
327 * pointed to by ndp, fmodep, and vap as necessary to perform the requested
328 * operation. This function is used for both opens of existing files, and
329 * creation of new files.
330 *
331 * Parameters: ndp The nami data pointer describing the
332 * file
333 * fmodep A pointer to an int containg the mode
334 * information to be used for the open
335 * vap A pointer to the vnode attribute
336 * descriptor to be used for the open
337 * authvp If non-null and VA_DP_AUTHENTICATE is set in vap,
338 * have a supporting filesystem verify that the file
339 * to be opened is on the same volume as authvp and
340 * that authvp is on an authenticated volume
341 *
342 * Indirect: * Contents of the data structures pointed
343 * to by the parameters are modified as
344 * necessary to the requested operation.
345 *
346 * Returns: 0 Success
347 * !0 errno value
348 *
349 * Notes: The kauth_filesec_t in 'vap', if any, is in host byte order.
350 *
351 * The contents of '*ndp' will be modified, based on the other
352 * arguments to this function, and to return file and directory
353 * data necessary to satisfy the requested operation.
354 *
355 * If the file does not exist and we are creating it, then the
356 * O_TRUNC flag will be cleared in '*fmodep' to indicate to the
357 * caller that the file was not truncated.
358 *
359 * If the file exists and the O_EXCL flag was not specified, then
360 * the O_CREAT flag will be cleared in '*fmodep' to indicate to
361 * the caller that the existing file was merely opened rather
362 * than created.
363 *
364 * The contents of '*vap' will be modified as necessary to
365 * complete the operation, including setting of supported
366 * attribute, clearing of fields containing unsupported attributes
367 * in the request, if the request proceeds without them, etc..
368 *
369 * XXX: This function is too complicated in actings on its arguments
370 *
371 * XXX: We should enummerate the possible errno values here, and where
372 * in the code they originated.
373 */
374 int
vn_open_auth(struct nameidata * ndp,int * fmodep,struct vnode_attr * vap,vnode_t authvp)375 vn_open_auth(struct nameidata *ndp, int *fmodep, struct vnode_attr *vap, vnode_t authvp)
376 {
377 struct vnode *vp;
378 struct vnode *dvp;
379 vfs_context_t ctx = ndp->ni_cnd.cn_context;
380 int error;
381 int fmode;
382 uint32_t origcnflags;
383 boolean_t did_create;
384 boolean_t did_open;
385 boolean_t need_vnop_open;
386 boolean_t batched;
387 boolean_t ref_failed;
388 int nretries = 0;
389
390 again:
391 vp = NULL;
392 dvp = NULL;
393 batched = FALSE;
394 did_create = FALSE;
395 need_vnop_open = TRUE;
396 ref_failed = FALSE;
397 fmode = *fmodep;
398 origcnflags = ndp->ni_cnd.cn_flags;
399
400 if (VATTR_IS_ACTIVE(vap, va_dataprotect_flags)) {
401 if ((authvp != NULLVP)
402 && !ISSET(vap->va_dataprotect_flags, VA_DP_AUTHENTICATE)) {
403 error = EINVAL;
404 goto out;
405 }
406 // If raw encrypted mode is requested, handle that here
407 if (ISSET(vap->va_dataprotect_flags, VA_DP_RAWENCRYPTED)) {
408 fmode |= FENCRYPTED;
409 }
410 }
411
412 if ((fmode & O_NOFOLLOW_ANY) && (fmode & O_NOFOLLOW)) {
413 error = EINVAL;
414 goto out;
415 }
416
417 /*
418 * We only call nameidone when exiting the function because we may
419 * end up needing the pathname buffer in the component structure.
420 */
421
422 /*
423 * O_CREAT
424 */
425 if (fmode & O_CREAT) {
426 if ((fmode & O_DIRECTORY)) {
427 error = EINVAL;
428 goto out;
429 }
430 ndp->ni_cnd.cn_nameiop = CREATE;
431 #if CONFIG_TRIGGERS
432 ndp->ni_op = OP_LINK;
433 #endif
434 /* Inherit USEDVP, vnode_open() supported flags only */
435 ndp->ni_cnd.cn_flags &= (USEDVP | NOCROSSMOUNT);
436 ndp->ni_cnd.cn_flags |= LOCKPARENT | LOCKLEAF | AUDITVNPATH1;
437 /* Inherit NAMEI_ROOTDIR flag only */
438 ndp->ni_flag &= NAMEI_ROOTDIR;
439 ndp->ni_flag |= NAMEI_COMPOUNDOPEN;
440 #if NAMEDRSRCFORK
441 /* open calls are allowed for resource forks. */
442 ndp->ni_cnd.cn_flags |= CN_ALLOWRSRCFORK;
443 #endif
444 if ((fmode & O_EXCL) == 0 && (fmode & O_NOFOLLOW) == 0 && (origcnflags & FOLLOW) != 0) {
445 ndp->ni_cnd.cn_flags |= FOLLOW;
446 }
447 if (fmode & O_NOFOLLOW_ANY) {
448 /* will return ELOOP on the first symlink to be hit */
449 ndp->ni_flag |= NAMEI_NOFOLLOW_ANY;
450 }
451 if (fmode & O_RESOLVE_BENEATH) {
452 /* will return EACCES if path resolution escapes the starting directory */
453 ndp->ni_flag |= NAMEI_RESOLVE_BENEATH;
454 }
455
456 continue_create_lookup:
457 if ((error = namei(ndp))) {
458 goto out;
459 }
460
461 dvp = ndp->ni_dvp;
462 vp = ndp->ni_vp;
463
464 batched = vnode_compound_open_available(dvp);
465
466 /* not found, create */
467 if (vp == NULL) {
468 /* must have attributes for a new file */
469 if (vap == NULL) {
470 vnode_put(dvp);
471 error = EINVAL;
472 goto out;
473 }
474 /*
475 * Attempt a create. For a system supporting compound VNOPs, we may
476 * find an existing file or create one; in either case, we will already
477 * have the file open and no VNOP_OPEN() will be needed.
478 */
479 error = vn_open_auth_do_create(ndp, vap, fmode, &did_create, &did_open, ctx);
480
481 dvp = ndp->ni_dvp;
482 vp = ndp->ni_vp;
483
484 /* Detected a node that the filesystem couldn't handle */
485 if (error == EKEEPLOOKING) {
486 if (!batched) {
487 panic("EKEEPLOOKING from a filesystem that doesn't support compound VNOPs?");
488 }
489 goto continue_create_lookup;
490 }
491
492 if (dvp) {
493 panic("Shouldn't have a dvp here.");
494 }
495
496 if (error) {
497 /*
498 * Check for a create race.
499 */
500 if ((error == EEXIST) && !(fmode & O_EXCL)) {
501 if (vp) {
502 vnode_put(vp);
503 }
504 nameidone(ndp);
505 goto again;
506 }
507 goto bad;
508 }
509
510 need_vnop_open = !did_open;
511 } else {
512 if (fmode & O_EXCL) {
513 error = EEXIST;
514 }
515
516 /*
517 * We have a vnode. Use compound open if available
518 * or else fall through to "traditional" path. Note: can't
519 * do a compound open for root, because the parent belongs
520 * to a different FS.
521 */
522 if (error == 0 && batched && (vnode_mount(dvp) == vnode_mount(vp))) {
523 error = VNOP_COMPOUND_OPEN(dvp, &ndp->ni_vp, ndp, 0, fmode, NULL, NULL, ctx);
524
525 if (error == 0) {
526 vp = ndp->ni_vp;
527 need_vnop_open = FALSE;
528 } else if (error == EKEEPLOOKING) {
529 if ((ndp->ni_flag & NAMEI_CONTLOOKUP) == 0) {
530 panic("EKEEPLOOKING, but continue flag not set?");
531 }
532 goto continue_create_lookup;
533 }
534 }
535 vnode_put(dvp);
536 ndp->ni_dvp = NULLVP;
537
538 if (error) {
539 goto bad;
540 }
541
542 fmode &= ~O_CREAT;
543
544 /* Fall through */
545 }
546 } else {
547 /*
548 * Not O_CREAT
549 */
550 ndp->ni_cnd.cn_nameiop = LOOKUP;
551 /* Inherit USEDVP, vnode_open() supported flags only */
552 ndp->ni_cnd.cn_flags &= (USEDVP | NOCROSSMOUNT);
553 ndp->ni_cnd.cn_flags |= FOLLOW | LOCKLEAF | AUDITVNPATH1 | WANTPARENT;
554 #if NAMEDRSRCFORK
555 /* open calls are allowed for resource forks. */
556 ndp->ni_cnd.cn_flags |= CN_ALLOWRSRCFORK;
557 #endif
558 if (fmode & FENCRYPTED) {
559 ndp->ni_cnd.cn_flags |= CN_RAW_ENCRYPTED | CN_SKIPNAMECACHE;
560 }
561 /* Inherit NAMEI_ROOTDIR flag only */
562 ndp->ni_flag &= NAMEI_ROOTDIR;
563 ndp->ni_flag |= NAMEI_COMPOUNDOPEN;
564
565 /* preserve NOFOLLOW from vnode_open() */
566 if (fmode & O_NOFOLLOW || fmode & O_SYMLINK || (origcnflags & FOLLOW) == 0) {
567 ndp->ni_cnd.cn_flags &= ~FOLLOW;
568 }
569 if (fmode & O_NOFOLLOW_ANY) {
570 /* will return ELOOP on the first symlink to be hit */
571 ndp->ni_flag |= NAMEI_NOFOLLOW_ANY;
572 }
573 if (fmode & O_RESOLVE_BENEATH) {
574 /* will return EACCES if path resolution escapes the starting directory */
575 ndp->ni_flag |= NAMEI_RESOLVE_BENEATH;
576 }
577
578 /* Do a lookup, possibly going directly to filesystem for compound operation */
579 do {
580 if ((error = namei(ndp))) {
581 goto out;
582 }
583 vp = ndp->ni_vp;
584 dvp = ndp->ni_dvp;
585
586 /* Check for batched lookup-open */
587 batched = vnode_compound_open_available(dvp);
588 if (batched && ((vp == NULLVP) || (vnode_mount(dvp) == vnode_mount(vp)))) {
589 error = VNOP_COMPOUND_OPEN(dvp, &ndp->ni_vp, ndp, 0, fmode, NULL, NULL, ctx);
590 vp = ndp->ni_vp;
591 if (error == 0) {
592 need_vnop_open = FALSE;
593 } else if (error == EKEEPLOOKING) {
594 if ((ndp->ni_flag & NAMEI_CONTLOOKUP) == 0) {
595 panic("EKEEPLOOKING, but continue flag not set?");
596 }
597 } else if ((fmode & (FREAD | FWRITE | FEXEC)) == FEXEC) {
598 /*
599 * Some file systems fail in vnop_open call with absense of
600 * both FREAD and FWRITE access modes. Retry the vnop_open
601 * call again with FREAD access mode added.
602 */
603 error = VNOP_COMPOUND_OPEN(dvp, &ndp->ni_vp, ndp, 0,
604 fmode | FREAD, NULL, NULL, ctx);
605 if (error == 0) {
606 vp = ndp->ni_vp;
607 need_vnop_open = FALSE;
608 }
609 }
610 }
611 } while (error == EKEEPLOOKING);
612
613 vnode_put(dvp);
614 ndp->ni_dvp = NULLVP;
615
616 if (error) {
617 goto bad;
618 }
619 }
620
621 /*
622 * By this point, dvp iocount is dropped and dvp pointer is cleared.
623 */
624 if (ndp->ni_dvp != NULLVP) {
625 panic("Haven't cleaned up adequately in vn_open_auth()");
626 }
627
628 /*
629 * Expect to use this code for filesystems without compound VNOPs, for the root
630 * of a filesystem, which can't be "looked up" in the sense of VNOP_LOOKUP(),
631 * and for shadow files, which do not live on the same filesystems as their "parents."
632 */
633 if (need_vnop_open) {
634 if (batched && !vnode_isvroot(vp) && !vnode_isnamedstream(vp)) {
635 panic("Why am I trying to use VNOP_OPEN() on anything other than the root or a named stream?");
636 }
637
638 if (!did_create) {
639 error = vn_authorize_open_existing(vp, &ndp->ni_cnd, fmode, ctx, NULL);
640 if (error) {
641 goto bad;
642 }
643 }
644
645 if (VATTR_IS_ACTIVE(vap, va_dataprotect_flags)) {
646 if (ISSET(vap->va_dataprotect_flags, VA_DP_RAWUNENCRYPTED)) {
647 /* Don't allow unencrypted io request from user space unless entitled */
648 boolean_t entitled = FALSE;
649 #if !SECURE_KERNEL
650 entitled = IOCurrentTaskHasEntitlement("com.apple.private.security.file-unencrypt-access");
651 #endif /* SECURE_KERNEL */
652 if (!entitled) {
653 error = EPERM;
654 goto bad;
655 }
656 fmode |= FUNENCRYPTED;
657 }
658
659 if (ISSET(vap->va_dataprotect_flags, VA_DP_AUTHENTICATE)) {
660 fsioc_auth_fs_t afs = { .authvp = authvp };
661
662 error = VNOP_IOCTL(vp, FSIOC_AUTH_FS, (caddr_t)&afs, 0, ctx);
663 if (error) {
664 goto bad;
665 }
666 }
667 }
668
669 error = VNOP_OPEN(vp, fmode, ctx);
670 if (error) {
671 /*
672 * Some file systems fail in vnop_open call with absense of both
673 * FREAD and FWRITE access modes. Retry the vnop_open call again
674 * with FREAD access mode added.
675 */
676 if ((fmode & (FREAD | FWRITE | FEXEC)) == FEXEC) {
677 error = VNOP_OPEN(vp, fmode | FREAD, ctx);
678 }
679 if (error) {
680 goto bad;
681 }
682 }
683 need_vnop_open = FALSE;
684 }
685
686 // if the vnode is tagged VOPENEVT and the current process
687 // has the P_CHECKOPENEVT flag set, then we or in the O_EVTONLY
688 // flag to the open mode so that this open won't count against
689 // the vnode when carbon delete() does a vnode_isinuse() to see
690 // if a file is currently in use. this allows spotlight
691 // importers to not interfere with carbon apps that depend on
692 // the no-delete-if-busy semantics of carbon delete().
693 //
694 if (!did_create && (vp->v_flag & VOPENEVT) && (current_proc()->p_flag & P_CHECKOPENEVT)) {
695 fmode |= O_EVTONLY;
696 }
697
698 /*
699 * Grab reference, etc.
700 */
701 error = vn_open_auth_finish(vp, fmode, ctx);
702 if (error) {
703 ref_failed = TRUE;
704 goto bad;
705 }
706
707 /* Compound VNOP open is responsible for doing the truncate */
708 if (batched || did_create) {
709 fmode &= ~O_TRUNC;
710 }
711
712 *fmodep = fmode;
713 nameidone(ndp);
714 return 0;
715
716 bad:
717 /* Opened either explicitly or by a batched create */
718 if (!need_vnop_open) {
719 VNOP_CLOSE(vp, fmode, ctx);
720 }
721
722 ndp->ni_vp = NULL;
723 if (vp) {
724 #if NAMEDRSRCFORK
725 /* Aggressively recycle shadow files if we error'd out during open() */
726 if ((vnode_isnamedstream(vp)) &&
727 (vp->v_parent != NULLVP) &&
728 (vnode_isshadow(vp))) {
729 vnode_recycle(vp);
730 }
731 #endif
732 vnode_put(vp);
733 /*
734 * Check for a race against unlink. We had a vnode
735 * but according to vnode_authorize or VNOP_OPEN it
736 * no longer exists.
737 *
738 * EREDRIVEOPEN: means that we were hit by the tty allocation race or NFSv4 open/create race.
739 */
740 if (((error == ENOENT) && (*fmodep & O_CREAT)) || (error == EREDRIVEOPEN) || ref_failed) {
741 /*
742 * We'll retry here but it may be possible that we get
743 * into a retry "spin" inside the kernel and not allow
744 * threads, which need to run in order for the retry
745 * loop to end, to run. An example is an open of a
746 * terminal which is getting revoked and we spin here
747 * without yielding becasue namei and VNOP_OPEN are
748 * successful but vnode_ref fails. The revoke needs
749 * threads with an iocount to run but if spin here we
750 * may possibly be blcoking other threads from running.
751 *
752 * We start yielding the CPU after some number of
753 * retries for increasing durations. Note that this is
754 * still a loop without an exit condition.
755 */
756 nretries += 1;
757 if (nretries > RETRY_NO_YIELD_COUNT) {
758 /* Every hz/100 secs is 10 msecs ... */
759 tsleep(&nretries, PVFS, "vn_open_auth_retry",
760 MIN((nretries * (hz / 100)), hz));
761 }
762 nameidone(ndp);
763 goto again;
764 }
765 }
766
767 out:
768 nameidone(ndp);
769 return error;
770 }
771
772 #if vn_access_DEPRECATED
773 /*
774 * Authorize an action against a vnode. This has been the canonical way to
775 * ensure that the credential/process/etc. referenced by a vfs_context
776 * is granted the rights called out in 'mode' against the vnode 'vp'.
777 *
778 * Unfortunately, the use of VREAD/VWRITE/VEXEC makes it very difficult
779 * to add support for more rights. As such, this interface will be deprecated
780 * and callers will use vnode_authorize instead.
781 */
782 int
vn_access(vnode_t vp,int mode,vfs_context_t context)783 vn_access(vnode_t vp, int mode, vfs_context_t context)
784 {
785 kauth_action_t action;
786
787 action = 0;
788 if (mode & VREAD) {
789 action |= KAUTH_VNODE_READ_DATA;
790 }
791 if (mode & VWRITE) {
792 action |= KAUTH_VNODE_WRITE_DATA;
793 }
794 if (mode & VEXEC) {
795 action |= KAUTH_VNODE_EXECUTE;
796 }
797
798 return vnode_authorize(vp, NULL, action, context);
799 }
800 #endif /* vn_access_DEPRECATED */
801
802 /*
803 * Vnode close call
804 */
805 int
vn_close(struct vnode * vp,int flags,vfs_context_t ctx)806 vn_close(struct vnode *vp, int flags, vfs_context_t ctx)
807 {
808 int error;
809 int flusherror = 0;
810
811 #if NAMEDRSRCFORK
812 /* Sync data from resource fork shadow file if needed. */
813 if ((vp->v_flag & VISNAMEDSTREAM) &&
814 (vp->v_parent != NULLVP) &&
815 vnode_isshadow(vp)) {
816 if (flags & FWASWRITTEN) {
817 flusherror = vnode_flushnamedstream(vp->v_parent, vp, ctx);
818 }
819 }
820 #endif
821 /*
822 * If vnode @vp belongs to a chardev or a blkdev then it is handled
823 * specially. We first drop its user reference count @vp->v_usecount
824 * before calling VNOP_CLOSE(). This was done historically to ensure
825 * that the last close of a special device vnode performed some
826 * conditional cleanups. Now we still need to drop this reference here
827 * to ensure that devfsspec_close() can check if the vnode is still in
828 * use.
829 */
830 if (vnode_isspec(vp)) {
831 (void)vnode_rele_ext(vp, flags, 0);
832 }
833
834 /*
835 * On HFS, we flush when the last writer closes. We do this
836 * because resource fork vnodes hold a reference on data fork
837 * vnodes and that will prevent them from getting VNOP_INACTIVE
838 * which will delay when we flush cached data. In future, we
839 * might find it beneficial to do this for all file systems.
840 * Note that it's OK to access v_writecount without the lock
841 * in this context.
842 */
843 if (vp->v_tag == VT_HFS && (flags & FWRITE) && vp->v_writecount == 1) {
844 VNOP_FSYNC(vp, MNT_NOWAIT, ctx);
845 }
846
847 error = VNOP_CLOSE(vp, flags, ctx);
848
849 #if CONFIG_FSE
850 if (flags & FWASWRITTEN) {
851 if (need_fsevent(FSE_CONTENT_MODIFIED, vp)) {
852 add_fsevent(FSE_CONTENT_MODIFIED, ctx,
853 FSE_ARG_VNODE, vp,
854 FSE_ARG_DONE);
855 }
856 }
857 #endif
858
859 if (!vnode_isspec(vp)) {
860 (void)vnode_rele_ext(vp, flags, 0);
861 }
862
863 if (flusherror) {
864 error = flusherror;
865 }
866 return error;
867 }
868
869 static int
vn_read_swapfile(struct vnode * vp,uio_t uio)870 vn_read_swapfile(
871 struct vnode *vp,
872 uio_t uio)
873 {
874 int error;
875 off_t swap_count, this_count;
876 off_t file_end, read_end;
877 off_t prev_resid;
878 char *my_swap_page;
879
880 /*
881 * Reading from a swap file will get you zeroes.
882 */
883
884 my_swap_page = NULL;
885 error = 0;
886 swap_count = uio_resid(uio);
887
888 file_end = ubc_getsize(vp);
889 read_end = uio->uio_offset + uio_resid(uio);
890 if (uio->uio_offset >= file_end) {
891 /* uio starts after end of file: nothing to read */
892 swap_count = 0;
893 } else if (read_end > file_end) {
894 /* uio extends beyond end of file: stop before that */
895 swap_count -= (read_end - file_end);
896 }
897
898 while (swap_count > 0) {
899 if (my_swap_page == NULL) {
900 my_swap_page = kalloc_data(PAGE_SIZE, Z_WAITOK | Z_ZERO);
901 /* add an end-of-line to keep line counters happy */
902 my_swap_page[PAGE_SIZE - 1] = '\n';
903 }
904 this_count = swap_count;
905 if (this_count > PAGE_SIZE) {
906 this_count = PAGE_SIZE;
907 }
908
909 prev_resid = uio_resid(uio);
910 error = uiomove((caddr_t) my_swap_page,
911 (int)this_count,
912 uio);
913 if (error) {
914 break;
915 }
916 swap_count -= (prev_resid - uio_resid(uio));
917 }
918 kfree_data(my_swap_page, PAGE_SIZE);
919
920 return error;
921 }
922 /*
923 * Package up an I/O request on a vnode into a uio and do it.
924 */
925 int
vn_rdwr(enum uio_rw rw,struct vnode * vp,caddr_t base,int len,off_t offset,enum uio_seg segflg,int ioflg,kauth_cred_t cred,int * aresid,proc_t p)926 vn_rdwr(
927 enum uio_rw rw,
928 struct vnode *vp,
929 caddr_t base,
930 int len,
931 off_t offset,
932 enum uio_seg segflg,
933 int ioflg,
934 kauth_cred_t cred,
935 int *aresid,
936 proc_t p)
937 {
938 int64_t resid;
939 int result;
940
941 if (len < 0) {
942 return EINVAL;
943 }
944
945 result = vn_rdwr_64(rw,
946 vp,
947 (uint64_t)(uintptr_t)base,
948 (int64_t)len,
949 offset,
950 segflg,
951 ioflg,
952 cred,
953 &resid,
954 p);
955
956 /* "resid" should be bounded above by "len," which is an int */
957 if (aresid != NULL) {
958 *aresid = (int)resid;
959 }
960
961 return result;
962 }
963
964
965 int
vn_rdwr_64(enum uio_rw rw,struct vnode * vp,uint64_t base,int64_t len,off_t offset,enum uio_seg segflg,int ioflg,kauth_cred_t cred,int64_t * aresid,proc_t p)966 vn_rdwr_64(
967 enum uio_rw rw,
968 struct vnode *vp,
969 uint64_t base,
970 int64_t len,
971 off_t offset,
972 enum uio_seg segflg,
973 int ioflg,
974 kauth_cred_t cred,
975 int64_t *aresid,
976 proc_t p)
977 {
978 uio_t auio;
979 int spacetype;
980 struct vfs_context context;
981 int error = 0;
982 UIO_STACKBUF(uio_buf, 1);
983
984 context.vc_thread = current_thread();
985 context.vc_ucred = cred;
986
987 if (UIO_SEG_IS_USER_SPACE(segflg)) {
988 spacetype = proc_is64bit(p) ? UIO_USERSPACE64 : UIO_USERSPACE32;
989 } else {
990 spacetype = UIO_SYSSPACE;
991 }
992
993 if (len < 0) {
994 return EINVAL;
995 }
996
997 auio = uio_createwithbuffer(1, offset, spacetype, rw,
998 &uio_buf[0], sizeof(uio_buf));
999 uio_addiov(auio, CAST_USER_ADDR_T(base), (user_size_t)len);
1000
1001 #if CONFIG_MACF
1002 /* XXXMAC
1003 * IO_NOAUTH should be re-examined.
1004 * Likely that mediation should be performed in caller.
1005 */
1006 if ((ioflg & IO_NOAUTH) == 0) {
1007 /* passed cred is fp->f_cred */
1008 if (rw == UIO_READ) {
1009 error = mac_vnode_check_read(&context, cred, vp);
1010 } else {
1011 error = mac_vnode_check_write(&context, cred, vp);
1012 }
1013 }
1014 #endif
1015
1016 if (error == 0) {
1017 if (rw == UIO_READ) {
1018 if (vnode_isswap(vp) && ((ioflg & IO_SWAP_DISPATCH) == 0)) {
1019 error = vn_read_swapfile(vp, auio);
1020 } else {
1021 error = VNOP_READ(vp, auio, ioflg, &context);
1022 }
1023 } else {
1024 error = VNOP_WRITE(vp, auio, ioflg, &context);
1025 }
1026 }
1027
1028 if (aresid) {
1029 *aresid = uio_resid(auio);
1030 assert(*aresid <= len);
1031 } else if (uio_resid(auio) && error == 0) {
1032 error = EIO;
1033 }
1034 return error;
1035 }
1036
1037 void
vn_offset_lock(struct fileglob * fg)1038 vn_offset_lock(struct fileglob *fg)
1039 {
1040 lck_mtx_lock_spin(&fg->fg_lock);
1041 while (fg->fg_lflags & FG_OFF_LOCKED) {
1042 fg->fg_lflags |= FG_OFF_LOCKWANT;
1043 msleep(&fg->fg_lflags, &fg->fg_lock, PVFS | PSPIN,
1044 "fg_offset_lock_wait", 0);
1045 }
1046 fg->fg_lflags |= FG_OFF_LOCKED;
1047 lck_mtx_unlock(&fg->fg_lock);
1048 }
1049
1050 void
vn_offset_unlock(struct fileglob * fg)1051 vn_offset_unlock(struct fileglob *fg)
1052 {
1053 int lock_wanted = 0;
1054
1055 lck_mtx_lock_spin(&fg->fg_lock);
1056 if (fg->fg_lflags & FG_OFF_LOCKWANT) {
1057 lock_wanted = 1;
1058 }
1059 fg->fg_lflags &= ~(FG_OFF_LOCKED | FG_OFF_LOCKWANT);
1060 lck_mtx_unlock(&fg->fg_lock);
1061 if (lock_wanted) {
1062 wakeup(&fg->fg_lflags);
1063 }
1064 }
1065
1066 static int
vn_read_common(vnode_t vp,struct uio * uio,int fflag,vfs_context_t ctx)1067 vn_read_common(vnode_t vp, struct uio *uio, int fflag, vfs_context_t ctx)
1068 {
1069 int error;
1070 int ioflag;
1071 off_t read_offset;
1072 user_ssize_t read_len;
1073 user_ssize_t adjusted_read_len;
1074 user_ssize_t clippedsize;
1075
1076 /* Caller has already validated read_len. */
1077 read_len = uio_resid(uio);
1078 assert(read_len >= 0 && read_len <= INT_MAX);
1079
1080 adjusted_read_len = read_len;
1081 clippedsize = 0;
1082
1083 #if CONFIG_MACF
1084 error = mac_vnode_check_read(ctx, vfs_context_ucred(ctx), vp);
1085 if (error) {
1086 return error;
1087 }
1088 #endif
1089
1090 /* This signals to VNOP handlers that this read came from a file table read */
1091 ioflag = IO_SYSCALL_DISPATCH;
1092
1093 if (fflag & FNONBLOCK) {
1094 ioflag |= IO_NDELAY;
1095 }
1096 if ((fflag & FNOCACHE) || vnode_isnocache(vp)) {
1097 ioflag |= IO_NOCACHE;
1098 }
1099 if (fflag & FENCRYPTED) {
1100 ioflag |= IO_ENCRYPTED;
1101 }
1102 if (fflag & FUNENCRYPTED) {
1103 ioflag |= IO_SKIP_ENCRYPTION;
1104 }
1105 if (fflag & O_EVTONLY) {
1106 ioflag |= IO_EVTONLY;
1107 }
1108 if (fflag & FNORDAHEAD) {
1109 ioflag |= IO_RAOFF;
1110 }
1111
1112 read_offset = uio_offset(uio);
1113 /* POSIX allows negative offsets for character devices. */
1114 if ((read_offset < 0) && (vnode_vtype(vp) != VCHR)) {
1115 error = EINVAL;
1116 goto error_out;
1117 }
1118
1119 if (read_offset == INT64_MAX) {
1120 /* can't read any more */
1121 error = 0;
1122 goto error_out;
1123 }
1124
1125 /*
1126 * If offset + len will cause overflow, reduce the len to a value
1127 * (adjusted_read_len) where it won't
1128 */
1129 if ((read_offset >= 0) && (INT64_MAX - read_offset) < read_len) {
1130 /*
1131 * 0 read_offset INT64_MAX
1132 * |-----------------------------------------------|----------|~~~
1133 * <--read_len-->
1134 * <-adjusted->
1135 */
1136 adjusted_read_len = (user_ssize_t)(INT64_MAX - read_offset);
1137 }
1138
1139 if (adjusted_read_len < read_len) {
1140 uio_setresid(uio, adjusted_read_len);
1141 clippedsize = read_len - adjusted_read_len;
1142 }
1143
1144 if (vnode_isswap(vp) && !(IO_SKIP_ENCRYPTION & ioflag)) {
1145 /* special case for swap files */
1146 error = vn_read_swapfile(vp, uio);
1147 } else {
1148 error = VNOP_READ(vp, uio, ioflag, ctx);
1149 }
1150
1151 if (clippedsize) {
1152 uio_setresid(uio, (uio_resid(uio) + clippedsize));
1153 }
1154
1155 error_out:
1156 return error;
1157 }
1158
1159 /*
1160 * File table vnode read routine.
1161 */
1162 static int
vn_read(struct fileproc * fp,struct uio * uio,int flags,vfs_context_t ctx)1163 vn_read(struct fileproc *fp, struct uio *uio, int flags, vfs_context_t ctx)
1164 {
1165 vnode_t vp;
1166 user_ssize_t read_len;
1167 int error;
1168 bool offset_locked;
1169
1170 read_len = uio_resid(uio);
1171 if (read_len < 0 || read_len > INT_MAX) {
1172 return EINVAL;
1173 }
1174
1175 if ((flags & FOF_OFFSET) == 0) {
1176 vn_offset_lock(fp->fp_glob);
1177 offset_locked = true;
1178 } else {
1179 offset_locked = false;
1180 }
1181 vp = (struct vnode *)fp_get_data(fp);
1182 if ((error = vnode_getwithref(vp))) {
1183 if (offset_locked) {
1184 vn_offset_unlock(fp->fp_glob);
1185 }
1186 return error;
1187 }
1188
1189 if (offset_locked && (vnode_vtype(vp) != VREG || vnode_isswap(vp))) {
1190 vn_offset_unlock(fp->fp_glob);
1191 offset_locked = false;
1192 }
1193
1194 if ((flags & FOF_OFFSET) == 0) {
1195 uio_setoffset(uio, fp->fp_glob->fg_offset);
1196 }
1197
1198 error = vn_read_common(vp, uio, fp->fp_glob->fg_flag, ctx);
1199
1200 if ((flags & FOF_OFFSET) == 0) {
1201 fp->fp_glob->fg_offset += read_len - uio_resid(uio);
1202 }
1203
1204 if (offset_locked) {
1205 vn_offset_unlock(fp->fp_glob);
1206 offset_locked = false;
1207 }
1208
1209 vnode_put(vp);
1210 return error;
1211 }
1212
1213 /*
1214 * File table vnode write routine.
1215 */
1216 static int
vn_write(struct fileproc * fp,struct uio * uio,int flags,vfs_context_t ctx)1217 vn_write(struct fileproc *fp, struct uio *uio, int flags, vfs_context_t ctx)
1218 {
1219 struct vnode *vp;
1220 int error, ioflag;
1221 off_t write_offset;
1222 off_t write_end_offset;
1223 user_ssize_t write_len;
1224 user_ssize_t adjusted_write_len;
1225 user_ssize_t clippedsize;
1226 bool offset_locked;
1227 proc_t p = vfs_context_proc(ctx);
1228 rlim_t rlim_cur_fsize = p ? proc_limitgetcur(p, RLIMIT_FSIZE) : 0;
1229
1230 write_len = uio_resid(uio);
1231 if (write_len < 0 || write_len > INT_MAX) {
1232 return EINVAL;
1233 }
1234 adjusted_write_len = write_len;
1235 clippedsize = 0;
1236
1237 if ((flags & FOF_OFFSET) == 0) {
1238 vn_offset_lock(fp->fp_glob);
1239 offset_locked = true;
1240 } else {
1241 offset_locked = false;
1242 }
1243
1244 vp = (struct vnode *)fp_get_data(fp);
1245 if ((error = vnode_getwithref(vp))) {
1246 if (offset_locked) {
1247 vn_offset_unlock(fp->fp_glob);
1248 }
1249 return error;
1250 }
1251
1252 if (offset_locked && (vnode_vtype(vp) != VREG || vnode_isswap(vp))) {
1253 vn_offset_unlock(fp->fp_glob);
1254 offset_locked = false;
1255 }
1256
1257 #if CONFIG_MACF
1258 error = mac_vnode_check_write(ctx, vfs_context_ucred(ctx), vp);
1259 if (error) {
1260 (void)vnode_put(vp);
1261 if (offset_locked) {
1262 vn_offset_unlock(fp->fp_glob);
1263 }
1264 return error;
1265 }
1266 #endif
1267
1268 /*
1269 * IO_SYSCALL_DISPATCH signals to VNOP handlers that this write came from
1270 * a file table write
1271 */
1272 ioflag = (IO_UNIT | IO_SYSCALL_DISPATCH);
1273
1274 if (vp->v_type == VREG && (fp->fp_glob->fg_flag & O_APPEND)) {
1275 ioflag |= IO_APPEND;
1276 }
1277 if (fp->fp_glob->fg_flag & FNONBLOCK) {
1278 ioflag |= IO_NDELAY;
1279 }
1280 assert(!(fp->fp_glob->fg_flag & O_NOCTTY) || (fp->fp_glob->fg_flag & FNOCACHE));
1281 if ((fp->fp_glob->fg_flag & FNOCACHE) || vnode_isnocache(vp)) {
1282 ioflag |= IO_NOCACHE;
1283 /*
1284 * O_NOCTTY is repurposed to indicate the preference for relaxed
1285 * alignment and size restrictions. O_NOCTTY has no meaning beyond
1286 * the open of the fd and is used only for ttys and the use
1287 * is mutually exclusive with nocache io for regular files.
1288 */
1289 if (fp->fp_glob->fg_flag & O_NOCTTY || vfs_context_allow_fs_blksize_nocache_write(ctx)) {
1290 ioflag |= IO_NOCACHE_SWRITE;
1291 }
1292 }
1293 if (fp->fp_glob->fg_flag & FNODIRECT) {
1294 ioflag |= IO_NODIRECT;
1295 }
1296 if (fp->fp_glob->fg_flag & FSINGLE_WRITER) {
1297 ioflag |= IO_SINGLE_WRITER;
1298 }
1299 if (fp->fp_glob->fg_flag & O_EVTONLY) {
1300 ioflag |= IO_EVTONLY;
1301 }
1302
1303 /*
1304 * Treat synchronous mounts and O_FSYNC on the fd as equivalent.
1305 *
1306 * XXX We treat O_DSYNC as O_FSYNC for now, since we can not delay
1307 * XXX the non-essential metadata without some additional VFS work;
1308 * XXX the intent at this point is to plumb the interface for it.
1309 */
1310 if ((fp->fp_glob->fg_flag & (O_FSYNC | O_DSYNC)) ||
1311 (vp->v_mount && (vp->v_mount->mnt_flag & MNT_SYNCHRONOUS))) {
1312 ioflag |= IO_SYNC;
1313 }
1314
1315 if ((flags & FOF_OFFSET) == 0) {
1316 write_offset = fp->fp_glob->fg_offset;
1317 uio_setoffset(uio, write_offset);
1318 } else {
1319 /* for pwrite, append should be ignored */
1320 ioflag &= ~IO_APPEND;
1321 write_offset = uio_offset(uio);
1322 /* POSIX allows negative offsets for character devices. */
1323 if ((write_offset < 0) && (vnode_vtype(vp) != VCHR)) {
1324 error = EINVAL;
1325 goto error_out;
1326 }
1327 }
1328
1329 if (write_offset == INT64_MAX) {
1330 /* writes are not possible */
1331 error = EFBIG;
1332 goto error_out;
1333 }
1334
1335 /*
1336 * write_len is the original write length that was requested.
1337 * We may however need to reduce that becasue of two reasons
1338 *
1339 * 1) If write_offset + write_len will exceed OFF_T_MAX (i.e. INT64_MAX)
1340 * and/or
1341 * 2) If write_offset + write_len will exceed the administrative
1342 * limit for the maximum file size.
1343 *
1344 * In both cases the write will be denied if we can't write even a single
1345 * byte otherwise it will be "clipped" (i.e. a short write).
1346 */
1347
1348 /*
1349 * If offset + len will cause overflow, reduce the len
1350 * to a value (adjusted_write_len) where it won't
1351 */
1352 if ((write_offset >= 0) && (INT64_MAX - write_offset) < write_len) {
1353 /*
1354 * 0 write_offset INT64_MAX
1355 * |-----------------------------------------------|----------|~~~
1356 * <--write_len-->
1357 * <-adjusted->
1358 */
1359 adjusted_write_len = (user_ssize_t)(INT64_MAX - write_offset);
1360 }
1361
1362 /* write_end_offset will always be [0, INT64_MAX] */
1363 write_end_offset = write_offset + adjusted_write_len;
1364
1365 if (p && (vp->v_type == VREG) &&
1366 (rlim_cur_fsize != RLIM_INFINITY) &&
1367 (rlim_cur_fsize <= INT64_MAX) &&
1368 (write_end_offset > (off_t)rlim_cur_fsize)) {
1369 /*
1370 * If the requested residual would cause us to go past the
1371 * administrative limit, then we need to adjust the residual
1372 * down to cause fewer bytes than requested to be written. If
1373 * we can't do that (e.g. the residual is already 1 byte),
1374 * then we fail the write with EFBIG.
1375 */
1376 if (write_offset >= (off_t)rlim_cur_fsize) {
1377 /*
1378 * 0 rlim_fsize write_offset write_end INT64_MAX
1379 * |------------------------|----------|-------------|--------|
1380 * <--write_len-->
1381 *
1382 * write not permitted
1383 */
1384 psignal(p, SIGXFSZ);
1385 error = EFBIG;
1386 goto error_out;
1387 }
1388
1389 /*
1390 * 0 write_offset rlim_fsize write_end INT64_MAX
1391 * |------------------------|-----------|---------|------------|
1392 * <------write_len------>
1393 * <-adjusted-->
1394 */
1395 adjusted_write_len = (user_ssize_t)((off_t)rlim_cur_fsize - write_offset);
1396 assert((adjusted_write_len > 0) && (adjusted_write_len < write_len));
1397 }
1398
1399 if (adjusted_write_len < write_len) {
1400 uio_setresid(uio, adjusted_write_len);
1401 clippedsize = write_len - adjusted_write_len;
1402 }
1403
1404 error = VNOP_WRITE(vp, uio, ioflag, ctx);
1405
1406 /*
1407 * If we had to reduce the size of write requested either because
1408 * of rlimit or because it would have exceeded
1409 * maximum file size, we have to add that back to the residual so
1410 * it correctly reflects what we did in this function.
1411 */
1412 if (clippedsize) {
1413 uio_setresid(uio, (uio_resid(uio) + clippedsize));
1414 }
1415
1416 if ((flags & FOF_OFFSET) == 0) {
1417 if (ioflag & IO_APPEND) {
1418 fp->fp_glob->fg_offset = uio_offset(uio);
1419 } else {
1420 fp->fp_glob->fg_offset += (write_len - uio_resid(uio));
1421 }
1422 if (offset_locked) {
1423 vn_offset_unlock(fp->fp_glob);
1424 offset_locked = false;
1425 }
1426 }
1427
1428 /*
1429 * Set the credentials on successful writes
1430 */
1431 if ((error == 0) && (vp->v_tag == VT_NFS) && (UBCINFOEXISTS(vp))) {
1432 ubc_setcred(vp, vfs_context_ucred(ctx));
1433 }
1434
1435 #if CONFIG_FILE_LEASES
1436 /*
1437 * On success, break the parent dir lease as the file's attributes (size
1438 * and/or mtime) have changed. Best attempt to break lease, just drop the
1439 * the error upon failure as there is no point to return error when the
1440 * write has completed successfully.
1441 */
1442 if (__probable(error == 0)) {
1443 vnode_breakdirlease(vp, true, O_WRONLY);
1444 }
1445 #endif /* CONFIG_FILE_LEASES */
1446
1447 (void)vnode_put(vp);
1448 return error;
1449
1450 error_out:
1451 if (offset_locked) {
1452 vn_offset_unlock(fp->fp_glob);
1453 }
1454 (void)vnode_put(vp);
1455 return error;
1456 }
1457
1458 /*
1459 * File table vnode stat routine.
1460 *
1461 * Returns: 0 Success
1462 * EBADF
1463 * ENOMEM
1464 * vnode_getattr:???
1465 */
1466 int
vn_stat_noauth(struct vnode * vp,void * sbptr,kauth_filesec_t * xsec,int isstat64,int needsrealdev,vfs_context_t ctx,struct ucred * file_cred)1467 vn_stat_noauth(struct vnode *vp, void *sbptr, kauth_filesec_t *xsec, int isstat64,
1468 int needsrealdev, vfs_context_t ctx, struct ucred *file_cred)
1469 {
1470 struct vnode_attr va;
1471 int error;
1472 u_short mode;
1473 kauth_filesec_t fsec;
1474 struct stat *sb = (struct stat *)0; /* warning avoidance ; protected by isstat64 */
1475 struct stat64 * sb64 = (struct stat64 *)0; /* warning avoidance ; protected by isstat64 */
1476
1477 if (isstat64 != 0) {
1478 sb64 = (struct stat64 *)sbptr;
1479 } else {
1480 sb = (struct stat *)sbptr;
1481 }
1482 memset(&va, 0, sizeof(va));
1483 VATTR_INIT(&va);
1484 VATTR_WANTED(&va, va_fsid);
1485 VATTR_WANTED(&va, va_fileid);
1486 VATTR_WANTED(&va, va_mode);
1487 VATTR_WANTED(&va, va_type);
1488 VATTR_WANTED(&va, va_nlink);
1489 VATTR_WANTED(&va, va_uid);
1490 VATTR_WANTED(&va, va_gid);
1491 VATTR_WANTED(&va, va_rdev);
1492 VATTR_WANTED(&va, va_data_size);
1493 VATTR_WANTED(&va, va_access_time);
1494 VATTR_WANTED(&va, va_modify_time);
1495 VATTR_WANTED(&va, va_change_time);
1496 VATTR_WANTED(&va, va_create_time);
1497 VATTR_WANTED(&va, va_flags);
1498 VATTR_WANTED(&va, va_gen);
1499 VATTR_WANTED(&va, va_iosize);
1500 /* lower layers will synthesise va_total_alloc from va_data_size if required */
1501 VATTR_WANTED(&va, va_total_alloc);
1502 if (xsec != NULL) {
1503 VATTR_WANTED(&va, va_uuuid);
1504 VATTR_WANTED(&va, va_guuid);
1505 VATTR_WANTED(&va, va_acl);
1506 }
1507 if (needsrealdev) {
1508 va.va_vaflags = VA_REALFSID;
1509 }
1510 error = vnode_getattr(vp, &va, ctx);
1511 if (error) {
1512 goto out;
1513 }
1514 #if CONFIG_MACF
1515 /*
1516 * Give MAC polices a chance to reject or filter the attributes
1517 * returned by the filesystem. Note that MAC policies are consulted
1518 * *after* calling the filesystem because filesystems can return more
1519 * attributes than were requested so policies wouldn't be authoritative
1520 * is consulted beforehand. This also gives policies an opportunity
1521 * to change the values of attributes retrieved.
1522 */
1523 error = mac_vnode_check_getattr(ctx, file_cred, vp, &va);
1524 if (error) {
1525 goto out;
1526 }
1527 #endif
1528 /*
1529 * Copy from vattr table
1530 */
1531 if (isstat64 != 0) {
1532 sb64->st_dev = va.va_fsid;
1533 sb64->st_ino = (ino64_t)va.va_fileid;
1534 } else {
1535 sb->st_dev = va.va_fsid;
1536 sb->st_ino = (ino_t)va.va_fileid;
1537 }
1538 mode = va.va_mode;
1539 switch (vp->v_type) {
1540 case VREG:
1541 mode |= S_IFREG;
1542 break;
1543 case VDIR:
1544 mode |= S_IFDIR;
1545 break;
1546 case VBLK:
1547 mode |= S_IFBLK;
1548 break;
1549 case VCHR:
1550 mode |= S_IFCHR;
1551 break;
1552 case VLNK:
1553 mode |= S_IFLNK;
1554 break;
1555 case VSOCK:
1556 mode |= S_IFSOCK;
1557 break;
1558 case VFIFO:
1559 mode |= S_IFIFO;
1560 break;
1561 default:
1562 error = EBADF;
1563 goto out;
1564 }
1565 ;
1566 if (isstat64 != 0) {
1567 sb64->st_mode = mode;
1568 sb64->st_nlink = VATTR_IS_SUPPORTED(&va, va_nlink) ? va.va_nlink > UINT16_MAX ? UINT16_MAX : (u_int16_t)va.va_nlink : 1;
1569 sb64->st_uid = va.va_uid;
1570 sb64->st_gid = va.va_gid;
1571 sb64->st_rdev = va.va_rdev;
1572 sb64->st_size = va.va_data_size;
1573 sb64->st_atimespec = va.va_access_time;
1574 sb64->st_mtimespec = va.va_modify_time;
1575 sb64->st_ctimespec = va.va_change_time;
1576 if (VATTR_IS_SUPPORTED(&va, va_create_time)) {
1577 sb64->st_birthtimespec = va.va_create_time;
1578 } else {
1579 sb64->st_birthtimespec.tv_sec = sb64->st_birthtimespec.tv_nsec = 0;
1580 }
1581 sb64->st_blksize = va.va_iosize;
1582 sb64->st_flags = va.va_flags;
1583 sb64->st_blocks = roundup(va.va_total_alloc, 512) / 512;
1584 } else {
1585 sb->st_mode = mode;
1586 sb->st_nlink = VATTR_IS_SUPPORTED(&va, va_nlink) ? va.va_nlink > UINT16_MAX ? UINT16_MAX : (u_int16_t)va.va_nlink : 1;
1587 sb->st_uid = va.va_uid;
1588 sb->st_gid = va.va_gid;
1589 sb->st_rdev = va.va_rdev;
1590 sb->st_size = va.va_data_size;
1591 sb->st_atimespec = va.va_access_time;
1592 sb->st_mtimespec = va.va_modify_time;
1593 sb->st_ctimespec = va.va_change_time;
1594 sb->st_blksize = va.va_iosize;
1595 sb->st_flags = va.va_flags;
1596 sb->st_blocks = roundup(va.va_total_alloc, 512) / 512;
1597 }
1598
1599 /* if we're interested in extended security data and we got an ACL */
1600 if (xsec != NULL) {
1601 if (!VATTR_IS_SUPPORTED(&va, va_acl) &&
1602 !VATTR_IS_SUPPORTED(&va, va_uuuid) &&
1603 !VATTR_IS_SUPPORTED(&va, va_guuid)) {
1604 *xsec = KAUTH_FILESEC_NONE;
1605 } else {
1606 if (VATTR_IS_SUPPORTED(&va, va_acl) && (va.va_acl != NULL)) {
1607 fsec = kauth_filesec_alloc(va.va_acl->acl_entrycount);
1608 } else {
1609 fsec = kauth_filesec_alloc(0);
1610 }
1611 if (fsec == NULL) {
1612 error = ENOMEM;
1613 goto out;
1614 }
1615 fsec->fsec_magic = KAUTH_FILESEC_MAGIC;
1616 if (VATTR_IS_SUPPORTED(&va, va_uuuid)) {
1617 fsec->fsec_owner = va.va_uuuid;
1618 } else {
1619 fsec->fsec_owner = kauth_null_guid;
1620 }
1621 if (VATTR_IS_SUPPORTED(&va, va_guuid)) {
1622 fsec->fsec_group = va.va_guuid;
1623 } else {
1624 fsec->fsec_group = kauth_null_guid;
1625 }
1626 if (VATTR_IS_SUPPORTED(&va, va_acl) && (va.va_acl != NULL)) {
1627 __nochk_bcopy(va.va_acl, &(fsec->fsec_acl), KAUTH_ACL_COPYSIZE(va.va_acl));
1628 } else {
1629 fsec->fsec_acl.acl_entrycount = KAUTH_FILESEC_NOACL;
1630 }
1631 *xsec = fsec;
1632 }
1633 }
1634
1635 /* Do not give the generation number out to unpriviledged users */
1636 if (va.va_gen && !vfs_context_issuser(ctx)) {
1637 if (isstat64 != 0) {
1638 sb64->st_gen = 0;
1639 } else {
1640 sb->st_gen = 0;
1641 }
1642 } else {
1643 if (isstat64 != 0) {
1644 sb64->st_gen = va.va_gen;
1645 } else {
1646 sb->st_gen = va.va_gen;
1647 }
1648 }
1649
1650 error = 0;
1651 out:
1652 if (VATTR_IS_SUPPORTED(&va, va_acl) && va.va_acl != NULL) {
1653 kauth_acl_free(va.va_acl);
1654 }
1655 return error;
1656 }
1657
1658 int
vn_stat(struct vnode * vp,void * sb,kauth_filesec_t * xsec,int isstat64,int needsrealdev,vfs_context_t ctx)1659 vn_stat(struct vnode *vp, void *sb, kauth_filesec_t *xsec, int isstat64, int needsrealdev, vfs_context_t ctx)
1660 {
1661 int error;
1662
1663 #if CONFIG_MACF
1664 error = mac_vnode_check_stat(ctx, NOCRED, vp);
1665 if (error) {
1666 return error;
1667 }
1668 #endif
1669
1670 /* authorize */
1671 if ((error = vnode_authorize(vp, NULL, KAUTH_VNODE_READ_ATTRIBUTES | KAUTH_VNODE_READ_SECURITY, ctx)) != 0) {
1672 return error;
1673 }
1674
1675 /* actual stat */
1676 return vn_stat_noauth(vp, sb, xsec, isstat64, needsrealdev, ctx, NOCRED);
1677 }
1678
1679
1680 /*
1681 * File table vnode ioctl routine.
1682 */
1683 static int
vn_ioctl(struct fileproc * fp,u_long com,caddr_t data,vfs_context_t ctx)1684 vn_ioctl(struct fileproc *fp, u_long com, caddr_t data, vfs_context_t ctx)
1685 {
1686 struct vnode *vp = (struct vnode *)fp_get_data(fp);
1687 off_t file_size;
1688 int error;
1689 struct vnode *ttyvp;
1690
1691 if ((error = vnode_getwithref(vp))) {
1692 return error;
1693 }
1694
1695 #if CONFIG_MACF
1696 error = mac_vnode_check_ioctl(ctx, vp, com);
1697 if (error) {
1698 goto out;
1699 }
1700 #endif
1701
1702 switch (vp->v_type) {
1703 case VREG:
1704 case VDIR:
1705 if (com == FIONREAD) {
1706 off_t temp_nbytes;
1707 if ((error = vnode_size(vp, &file_size, ctx)) != 0) {
1708 goto out;
1709 }
1710 temp_nbytes = file_size - fp->fp_glob->fg_offset;
1711 if (temp_nbytes > INT_MAX) {
1712 *(int *)data = INT_MAX;
1713 } else if (temp_nbytes < 0) {
1714 *(int *)data = 0;
1715 } else {
1716 *(int *)data = (int)temp_nbytes;
1717 }
1718 goto out;
1719 }
1720 if (com == FIONBIO || com == FIOASYNC) { /* XXX */
1721 goto out;
1722 }
1723 OS_FALLTHROUGH;
1724
1725 default:
1726 error = ENOTTY;
1727 goto out;
1728
1729 case VFIFO:
1730 case VCHR:
1731 case VBLK:
1732
1733 if (com == TIOCREVOKE || com == TIOCREVOKECLEAR) {
1734 error = ENOTTY;
1735 goto out;
1736 }
1737
1738 /* Should not be able to set block size from user space */
1739 if (com == DKIOCSETBLOCKSIZE) {
1740 error = EPERM;
1741 goto out;
1742 }
1743
1744 /* Should not be able to check if filesystem is authenticated from user space */
1745 if (com == FSIOC_AUTH_FS) {
1746 error = ENOTTY;
1747 goto out;
1748 }
1749
1750 if (com == FIODTYPE) {
1751 if (vp->v_type == VBLK) {
1752 if (major(vp->v_rdev) >= nblkdev) {
1753 error = ENXIO;
1754 goto out;
1755 }
1756 *(int *)data = bdevsw[major(vp->v_rdev)].d_type;
1757 } else if (vp->v_type == VCHR) {
1758 if (major(vp->v_rdev) >= nchrdev) {
1759 error = ENXIO;
1760 goto out;
1761 }
1762 *(int *)data = cdevsw[major(vp->v_rdev)].d_type;
1763 } else {
1764 error = ENOTTY;
1765 goto out;
1766 }
1767 goto out;
1768 }
1769 error = VNOP_IOCTL(vp, com, data, fp->fp_glob->fg_flag, ctx);
1770
1771 if (error == 0 && com == TIOCSCTTY) {
1772 struct session *sessp;
1773 struct pgrp *pg;
1774
1775 pg = proc_pgrp(vfs_context_proc(ctx), &sessp);
1776
1777 session_lock(sessp);
1778 ttyvp = sessp->s_ttyvp;
1779 sessp->s_ttyvp = vp;
1780 sessp->s_ttyvid = vnode_vid(vp);
1781 session_unlock(sessp);
1782
1783 pgrp_rele(pg);
1784 }
1785 }
1786 out:
1787 (void)vnode_put(vp);
1788 return error;
1789 }
1790
1791 /*
1792 * File table vnode select routine.
1793 */
1794 static int
vn_select(struct fileproc * fp,int which,void * wql,__unused vfs_context_t ctx)1795 vn_select(struct fileproc *fp, int which, void *wql, __unused vfs_context_t ctx)
1796 {
1797 int error;
1798 struct vnode * vp = (struct vnode *)fp_get_data(fp);
1799 struct vfs_context context;
1800
1801 if ((error = vnode_getwithref(vp)) == 0) {
1802 context.vc_thread = current_thread();
1803 context.vc_ucred = fp->fp_glob->fg_cred;
1804
1805 #if CONFIG_MACF
1806 /*
1807 * XXX We should use a per thread credential here; minimally,
1808 * XXX the process credential should have a persistent
1809 * XXX reference on it before being passed in here.
1810 */
1811 error = mac_vnode_check_select(ctx, vp, which);
1812 if (error == 0)
1813 #endif
1814 error = VNOP_SELECT(vp, which, fp->fp_glob->fg_flag, wql, ctx);
1815
1816 (void)vnode_put(vp);
1817 }
1818 return error;
1819 }
1820
1821 /*
1822 * File table vnode close routine.
1823 */
1824 static int
vn_closefile(struct fileglob * fg,vfs_context_t ctx)1825 vn_closefile(struct fileglob *fg, vfs_context_t ctx)
1826 {
1827 struct vnode *vp = fg_get_data(fg);
1828 int error;
1829
1830 if ((error = vnode_getwithref(vp)) == 0) {
1831 if (FILEGLOB_DTYPE(fg) == DTYPE_VNODE &&
1832 ((fg->fg_flag & FWASLOCKED) != 0 ||
1833 (fg->fg_lflags & FG_HAS_OFDLOCK) != 0)) {
1834 struct flock lf = {
1835 .l_whence = SEEK_SET,
1836 .l_start = 0,
1837 .l_len = 0,
1838 .l_type = F_UNLCK
1839 };
1840
1841 if ((fg->fg_flag & FWASLOCKED) != 0) {
1842 (void) VNOP_ADVLOCK(vp, (caddr_t)fg,
1843 F_UNLCK, &lf, F_FLOCK, ctx, NULL);
1844 }
1845
1846 if ((fg->fg_lflags & FG_HAS_OFDLOCK) != 0) {
1847 (void) VNOP_ADVLOCK(vp, ofd_to_id(fg),
1848 F_UNLCK, &lf, F_OFD_LOCK, ctx, NULL);
1849 }
1850 }
1851 #if CONFIG_FILE_LEASES
1852 if (FILEGLOB_DTYPE(fg) == DTYPE_VNODE && !LIST_EMPTY(&vp->v_leases)) {
1853 /* Expected open count doesn't matter for release. */
1854 (void)vnode_setlease(vp, fg, F_UNLCK, 0, ctx);
1855 }
1856 #endif
1857 error = vn_close(vp, fg->fg_flag, ctx);
1858 (void) vnode_put(vp);
1859 }
1860 return error;
1861 }
1862
1863 /*
1864 * Returns: 0 Success
1865 * VNOP_PATHCONF:???
1866 */
1867 int
vn_pathconf(vnode_t vp,int name,int32_t * retval,vfs_context_t ctx)1868 vn_pathconf(vnode_t vp, int name, int32_t *retval, vfs_context_t ctx)
1869 {
1870 int error = 0;
1871 struct vfs_attr vfa;
1872
1873 switch (name) {
1874 case _PC_EXTENDED_SECURITY_NP:
1875 *retval = vfs_extendedsecurity(vnode_mount(vp)) ? 1 : 0;
1876 break;
1877 case _PC_AUTH_OPAQUE_NP:
1878 *retval = vfs_authopaque(vnode_mount(vp));
1879 break;
1880 case _PC_2_SYMLINKS:
1881 *retval = 1; /* XXX NOTSUP on MSDOS, etc. */
1882 break;
1883 case _PC_ALLOC_SIZE_MIN:
1884 *retval = 1; /* XXX lie: 1 byte */
1885 break;
1886 case _PC_ASYNC_IO: /* unistd.h: _POSIX_ASYNCHRONUS_IO */
1887 *retval = 1; /* [AIO] option is supported */
1888 break;
1889 case _PC_PRIO_IO: /* unistd.h: _POSIX_PRIORITIZED_IO */
1890 *retval = 0; /* [PIO] option is not supported */
1891 break;
1892 case _PC_REC_INCR_XFER_SIZE:
1893 *retval = 4096; /* XXX go from MIN to MAX 4K at a time */
1894 break;
1895 case _PC_REC_MIN_XFER_SIZE:
1896 *retval = 4096; /* XXX recommend 4K minimum reads/writes */
1897 break;
1898 case _PC_REC_MAX_XFER_SIZE:
1899 *retval = 65536; /* XXX recommend 64K maximum reads/writes */
1900 break;
1901 case _PC_REC_XFER_ALIGN:
1902 *retval = 4096; /* XXX recommend page aligned buffers */
1903 break;
1904 case _PC_SYMLINK_MAX:
1905 *retval = 255; /* Minimum acceptable POSIX value */
1906 break;
1907 case _PC_SYNC_IO: /* unistd.h: _POSIX_SYNCHRONIZED_IO */
1908 *retval = 0; /* [SIO] option is not supported */
1909 break;
1910 case _PC_XATTR_SIZE_BITS:
1911 /* The number of bits used to store maximum extended
1912 * attribute size in bytes. For example, if the maximum
1913 * attribute size supported by a file system is 128K, the
1914 * value returned will be 18. However a value 18 can mean
1915 * that the maximum attribute size can be anywhere from
1916 * (256KB - 1) to 128KB. As a special case, the resource
1917 * fork can have much larger size, and some file system
1918 * specific extended attributes can have smaller and preset
1919 * size; for example, Finder Info is always 32 bytes.
1920 */
1921 memset(&vfa, 0, sizeof(vfa));
1922 VFSATTR_INIT(&vfa);
1923 VFSATTR_WANTED(&vfa, f_capabilities);
1924 if (vfs_getattr(vnode_mount(vp), &vfa, ctx) == 0 &&
1925 (VFSATTR_IS_SUPPORTED(&vfa, f_capabilities)) &&
1926 (vfa.f_capabilities.capabilities[VOL_CAPABILITIES_INTERFACES] & VOL_CAP_INT_EXTENDED_ATTR) &&
1927 (vfa.f_capabilities.valid[VOL_CAPABILITIES_INTERFACES] & VOL_CAP_INT_EXTENDED_ATTR)) {
1928 /* Supports native extended attributes */
1929 error = VNOP_PATHCONF(vp, name, retval, ctx);
1930 } else {
1931 /* Number of bits used to represent the maximum size of
1932 * extended attribute stored in an Apple Double file.
1933 */
1934 *retval = AD_XATTR_SIZE_BITS;
1935 }
1936 break;
1937 default:
1938 error = VNOP_PATHCONF(vp, name, retval, ctx);
1939 break;
1940 }
1941
1942 return error;
1943 }
1944
1945 static int
vn_kqfilter(struct fileproc * fp,struct knote * kn,struct kevent_qos_s * kev)1946 vn_kqfilter(struct fileproc *fp, struct knote *kn, struct kevent_qos_s *kev)
1947 {
1948 vfs_context_t ctx = vfs_context_current();
1949 struct vnode *vp;
1950 int error = 0;
1951 int result = 0;
1952
1953 vp = (struct vnode *)fp_get_data(fp);
1954
1955 /*
1956 * Don't attach a knote to a dead vnode.
1957 */
1958 if ((error = vget_internal(vp, 0, VNODE_NODEAD)) == 0) {
1959 switch (kn->kn_filter) {
1960 case EVFILT_READ:
1961 case EVFILT_WRITE:
1962 if (vnode_isfifo(vp)) {
1963 /* We'll only watch FIFOs that use our fifofs */
1964 if (!(vp->v_fifoinfo && vp->v_fifoinfo->fi_readsock)) {
1965 error = ENOTSUP;
1966 }
1967 } else if (!vnode_isreg(vp)) {
1968 if (vnode_ischr(vp)) {
1969 result = spec_kqfilter(vp, kn, kev);
1970 if ((kn->kn_flags & EV_ERROR) == 0) {
1971 /* claimed by a special device */
1972 vnode_put(vp);
1973 return result;
1974 }
1975 }
1976 error = EINVAL;
1977 }
1978 break;
1979 case EVFILT_VNODE:
1980 break;
1981 default:
1982 error = EINVAL;
1983 }
1984
1985 if (error == 0) {
1986 #if CONFIG_MACF
1987 error = mac_vnode_check_kqfilter(ctx, fp->fp_glob->fg_cred, kn, vp);
1988 if (error) {
1989 vnode_put(vp);
1990 goto out;
1991 }
1992 #endif
1993
1994 kn->kn_filtid = EVFILTID_VN;
1995 knote_kn_hook_set_raw(kn, (void *)vp);
1996 vnode_hold(vp);
1997
1998 vnode_lock(vp);
1999 KNOTE_ATTACH(&vp->v_knotes, kn);
2000 result = filt_vnode_common(kn, NULL, vp, 0);
2001 vnode_unlock(vp);
2002
2003 /*
2004 * Ask the filesystem to provide remove notifications,
2005 * but ignore failure
2006 */
2007 VNOP_MONITOR(vp, 0, VNODE_MONITOR_BEGIN, (void*) kn, ctx);
2008 }
2009
2010 vnode_put(vp);
2011 }
2012
2013 out:
2014 if (error) {
2015 knote_set_error(kn, error);
2016 }
2017
2018 return result;
2019 }
2020
2021 static void
filt_vndetach(struct knote * kn)2022 filt_vndetach(struct knote *kn)
2023 {
2024 vfs_context_t ctx = vfs_context_current();
2025 struct vnode *vp = (struct vnode *)knote_kn_hook_get_raw(kn);
2026 uint32_t vid = vnode_vid(vp);
2027 if (vnode_getwithvid(vp, vid)) {
2028 vnode_drop(vp);
2029 return;
2030 }
2031 vnode_drop(vp);
2032
2033 vnode_lock(vp);
2034 KNOTE_DETACH(&vp->v_knotes, kn);
2035 vnode_unlock(vp);
2036
2037 /*
2038 * Tell a (generally networked) filesystem that we're no longer watching
2039 * If the FS wants to track contexts, it should still be using the one from
2040 * the VNODE_MONITOR_BEGIN.
2041 */
2042 VNOP_MONITOR(vp, 0, VNODE_MONITOR_END, (void*)kn, ctx);
2043 vnode_put(vp);
2044 }
2045
2046
2047 /*
2048 * Used for EVFILT_READ
2049 *
2050 * Takes only VFIFO or VREG. vnode is locked. We handle the "poll" case
2051 * differently than the regular case for VREG files. If not in poll(),
2052 * then we need to know current fileproc offset for VREG.
2053 */
2054 static int64_t
vnode_readable_data_count(vnode_t vp,off_t current_offset,int ispoll)2055 vnode_readable_data_count(vnode_t vp, off_t current_offset, int ispoll)
2056 {
2057 if (vnode_isfifo(vp)) {
2058 #if FIFO
2059 int cnt;
2060 int err = fifo_charcount(vp, &cnt);
2061 if (err == 0) {
2062 return (int64_t)cnt;
2063 } else
2064 #endif
2065 {
2066 return 0;
2067 }
2068 } else if (vnode_isreg(vp)) {
2069 if (ispoll) {
2070 return 1;
2071 }
2072
2073 off_t amount;
2074 amount = vp->v_un.vu_ubcinfo->ui_size - current_offset;
2075 if (amount > INT64_MAX) {
2076 return INT64_MAX;
2077 } else if (amount < INT64_MIN) {
2078 return INT64_MIN;
2079 } else {
2080 return (int64_t)amount;
2081 }
2082 } else {
2083 panic("Should never have an EVFILT_READ except for reg or fifo.");
2084 return 0;
2085 }
2086 }
2087
2088 /*
2089 * Used for EVFILT_WRITE.
2090 *
2091 * For regular vnodes, we can always write (1). For named pipes,
2092 * see how much space there is in the buffer. Nothing else is covered.
2093 */
2094 static intptr_t
vnode_writable_space_count(vnode_t vp)2095 vnode_writable_space_count(vnode_t vp)
2096 {
2097 if (vnode_isfifo(vp)) {
2098 #if FIFO
2099 long spc;
2100 int err = fifo_freespace(vp, &spc);
2101 if (err == 0) {
2102 return (intptr_t)spc;
2103 } else
2104 #endif
2105 {
2106 return (intptr_t)0;
2107 }
2108 } else if (vnode_isreg(vp)) {
2109 return (intptr_t)1;
2110 } else {
2111 panic("Should never have an EVFILT_READ except for reg or fifo.");
2112 return 0;
2113 }
2114 }
2115
2116 /*
2117 * Determine whether this knote should be active
2118 *
2119 * This is kind of subtle.
2120 * --First, notice if the vnode has been revoked: in so, override hint
2121 * --EVFILT_READ knotes are checked no matter what the hint is
2122 * --Other knotes activate based on hint.
2123 * --If hint is revoke, set special flags and activate
2124 */
2125 static int
filt_vnode_common(struct knote * kn,struct kevent_qos_s * kev,vnode_t vp,long hint)2126 filt_vnode_common(struct knote *kn, struct kevent_qos_s *kev, vnode_t vp, long hint)
2127 {
2128 int activate = 0;
2129 int64_t data = 0;
2130
2131 lck_mtx_assert(&vp->v_lock, LCK_MTX_ASSERT_OWNED);
2132
2133 /* Special handling for vnodes that are in recycle or already gone */
2134 if (NOTE_REVOKE == hint) {
2135 kn->kn_flags |= (EV_EOF | EV_ONESHOT);
2136 activate = 1;
2137
2138 if ((kn->kn_filter == EVFILT_VNODE) && (kn->kn_sfflags & NOTE_REVOKE)) {
2139 kn->kn_fflags |= NOTE_REVOKE;
2140 }
2141 } else {
2142 switch (kn->kn_filter) {
2143 case EVFILT_READ:
2144 data = vnode_readable_data_count(vp, kn->kn_fp->fp_glob->fg_offset, (kn->kn_flags & EV_POLL));
2145 activate = (data != 0);
2146 break;
2147 case EVFILT_WRITE:
2148 data = vnode_writable_space_count(vp);
2149 activate = (data != 0);
2150 break;
2151 case EVFILT_VNODE:
2152 /* Check events this note matches against the hint */
2153 if (kn->kn_sfflags & hint) {
2154 kn->kn_fflags |= (uint32_t)hint; /* Set which event occurred */
2155 }
2156 activate = (kn->kn_fflags != 0);
2157 break;
2158 default:
2159 panic("Invalid knote filter on a vnode!");
2160 }
2161 }
2162
2163 if (kev && activate) {
2164 knote_fill_kevent(kn, kev, data);
2165 }
2166
2167 return activate;
2168 }
2169
2170 static int
filt_vnode(struct knote * kn,long hint)2171 filt_vnode(struct knote *kn, long hint)
2172 {
2173 vnode_t vp = (struct vnode *)knote_kn_hook_get_raw(kn);
2174
2175 return filt_vnode_common(kn, NULL, vp, hint);
2176 }
2177
2178 static int
filt_vntouch(struct knote * kn,struct kevent_qos_s * kev)2179 filt_vntouch(struct knote *kn, struct kevent_qos_s *kev)
2180 {
2181 vnode_t vp = (struct vnode *)knote_kn_hook_get_raw(kn);
2182 uint32_t vid = vnode_vid(vp);
2183 int activate;
2184 int hint = 0;
2185
2186 vnode_lock(vp);
2187 if (vnode_getiocount(vp, vid, VNODE_NODEAD | VNODE_WITHID) != 0) {
2188 /* is recycled */
2189 hint = NOTE_REVOKE;
2190 }
2191
2192 /* accept new input fflags mask */
2193 kn->kn_sfflags = kev->fflags;
2194
2195 activate = filt_vnode_common(kn, NULL, vp, hint);
2196
2197 if (hint == 0) {
2198 vnode_put_locked(vp);
2199 }
2200 vnode_unlock(vp);
2201
2202 return activate;
2203 }
2204
2205 static int
filt_vnprocess(struct knote * kn,struct kevent_qos_s * kev)2206 filt_vnprocess(struct knote *kn, struct kevent_qos_s *kev)
2207 {
2208 vnode_t vp = (struct vnode *)knote_kn_hook_get_raw(kn);
2209 uint32_t vid = vnode_vid(vp);
2210 int activate;
2211 int hint = 0;
2212
2213 vnode_lock(vp);
2214 if (vnode_getiocount(vp, vid, VNODE_NODEAD | VNODE_WITHID) != 0) {
2215 /* Is recycled */
2216 hint = NOTE_REVOKE;
2217 }
2218 activate = filt_vnode_common(kn, kev, vp, hint);
2219
2220 /* Definitely need to unlock, may need to put */
2221 if (hint == 0) {
2222 vnode_put_locked(vp);
2223 }
2224 vnode_unlock(vp);
2225
2226 return activate;
2227 }
2228
2229 struct vniodesc {
2230 vnode_t vnio_vnode; /* associated vnode */
2231 int vnio_fflags; /* cached fileglob flags */
2232 };
2233
2234 errno_t
vnio_openfd(int fd,vniodesc_t * vniop)2235 vnio_openfd(int fd, vniodesc_t *vniop)
2236 {
2237 proc_t p = current_proc();
2238 struct fileproc *fp = NULL;
2239 vniodesc_t vnio;
2240 vnode_t vp;
2241 int error;
2242 bool need_drop = false;
2243
2244 vnio = kalloc_type(struct vniodesc, Z_WAITOK);
2245
2246 error = fp_getfvp(p, fd, &fp, &vp);
2247 if (error) {
2248 goto out;
2249 }
2250 need_drop = true;
2251
2252 if ((fp->fp_glob->fg_flag & (FREAD | FWRITE)) == 0) {
2253 error = EBADF;
2254 goto out;
2255 }
2256
2257 if (vnode_isswap(vp)) {
2258 error = EPERM;
2259 goto out;
2260 }
2261
2262 if (vp->v_type != VREG) {
2263 error = EFTYPE;
2264 goto out;
2265 }
2266
2267 error = vnode_getwithref(vp);
2268 if (error) {
2269 goto out;
2270 }
2271
2272 vnio->vnio_vnode = vp;
2273 vnio->vnio_fflags = fp->fp_glob->fg_flag;
2274
2275 (void)fp_drop(p, fd, fp, 0);
2276 need_drop = false;
2277
2278 error = vnode_ref_ext(vp, vnio->vnio_fflags, 0);
2279 if (error == 0) {
2280 *vniop = vnio;
2281 vnio = NULL;
2282 }
2283
2284 vnode_put(vp);
2285
2286 out:
2287 if (need_drop) {
2288 fp_drop(p, fd, fp, 0);
2289 }
2290 if (vnio != NULL) {
2291 kfree_type(struct vniodesc, vnio);
2292 }
2293 return error;
2294 }
2295
2296 errno_t
vnio_close(vniodesc_t vnio)2297 vnio_close(vniodesc_t vnio)
2298 {
2299 int error;
2300
2301 /*
2302 * The vniodesc is always destroyed, because the close
2303 * always "succeeds". We just return whatever error
2304 * might have been encountered while doing so.
2305 */
2306
2307 error = vnode_getwithref(vnio->vnio_vnode);
2308 if (error == 0) {
2309 error = vnode_close(vnio->vnio_vnode, vnio->vnio_fflags, NULL);
2310 }
2311
2312 kfree_type(struct vniodesc, vnio);
2313
2314 return error;
2315 }
2316
2317 errno_t
vnio_read(vniodesc_t vnio,uio_t uio)2318 vnio_read(vniodesc_t vnio, uio_t uio)
2319 {
2320 vnode_t vp = vnio->vnio_vnode;
2321 user_ssize_t read_len;
2322 int error;
2323
2324 read_len = uio_resid(uio);
2325 if (read_len < 0 || read_len > INT_MAX) {
2326 return EINVAL;
2327 }
2328
2329 error = vnode_getwithref(vp);
2330 if (error == 0) {
2331 error = vn_read_common(vp, uio, vnio->vnio_fflags,
2332 vfs_context_current());
2333 vnode_put(vp);
2334 }
2335
2336 return error;
2337 }
2338
2339 vnode_t
vnio_vnode(vniodesc_t vnio)2340 vnio_vnode(vniodesc_t vnio)
2341 {
2342 return vnio->vnio_vnode;
2343 }
2344
2345 int
vnode_isauthfs(vnode_t vp)2346 vnode_isauthfs(vnode_t vp)
2347 {
2348 fsioc_auth_fs_t afs = { .authvp = NULL };
2349 int error;
2350
2351 error = VNOP_IOCTL(vp, FSIOC_AUTH_FS, (caddr_t)&afs, 0,
2352 vfs_context_current());
2353
2354 return error == 0 ? 1 : 0;
2355 }
2356